Winamp Skin Flaw Patched Modified Skin Installer Mechanism in Version 5.05 Ryan Naraine
America Online's Nullsoft division has released a patch to fix a vulnerability in the popular skinning feature in its Winamp media player.
Just days after security researchers warned a zero-day exploit was circulating in the wild, Nullsoft released Winamp 5.05 to modify the way the skin installer mechanism works.
According to the Nullsoft advisory, Winamp will now prompt all users with a confirmation window before installing any skins and will only extract files considered low risk before loading a Winamp skin.
The flaw, rated "extremely critical" by network security firm Secunia, affects Winamp versions 3.0, 5.0, and 5.0 Pro.
An active exploit, which has been spreading on Internet Relay Chat (IRC) (define)
networks, is being used to forcefully install spyware (define) and Trojans on infected systems.
Winamp skins have a huge following because they allow users to adopt colorful, customizable, and interchangeable sets of graphics that change the look and feel of the software.
